Skip to content
hamzasakhi_
~/about.mdx

$ whoami && cat about.mdx

Hamza Sakhi — penetration tester, red teamer, and application security lead based in Islamabad, Pakistan.

❯_

About

Hamza Sakhi — penetration tester, red teamer, and application security lead based in Islamabad, Pakistan.

I'm Hamza Sakhi, a penetration tester and Manager at ABHI Microfinance Bank — a microfinance bank in Pakistan. I've spent 4+ years in offensive security: leading pentesting contracts across web, API, mobile, cloud and internal infrastructure/Active Directory environments, running vulnerability assessments and incident response.

Most of my work sits at the point where an attacker's perspective becomes a defender's roadmap. Finding the flaw is the easy half — the part that matters is writing it up so an engineering team can reproduce it, understand what it actually costs the business, and ship a fix that holds. Alongside client engagements I work as a red teamer, security researcher, and cybersecurity instructor.

Outside of contract work I build offensive tooling: recon automation, red-team web apps, malware analysis utilities, and SOC log-analysis pipelines. I'm ranked #24 in PortSwigger's Hall of Fame, with all 269 Web Security Academy labs solved.

Based in Islamabad. Available for penetration testing and red team contracts — see what I work on.

Skills#

  • Offensive Security: Web, API, mobile and cloud penetration testing; infrastructure and Active Directory pentesting; red teaming and adversary simulation; vulnerability assessment; social engineering.
  • Infrastructure & AD Tooling: BloodHound, SharpHound, CrackMapExec (NetExec), Impacket, Rubeus, Certify, Mimikatz, Responder, ntlmrelayx, PetitPotam, Certipy, PowerView, ADCSPwn.
  • Application Security: Secure code review, SAST/DAST integration with SonarQube and Snyk, threat modelling, SDLC security.
  • Core Tooling: Burp Suite, Nmap, Nessus, Metasploit, Wireshark, MobSF, Frida, Gobuster, ffuf, Amass, Nikto, wpscan, sqlmap, Hashcat, John the Ripper.
  • Programming: Python, Bash, JavaScript, C++, PowerShell.
  • Platforms: Linux, Windows, Active Directory, Android, iOS, AWS, Azure.

Experience#

For detailed experience and work history, please visit my LinkedIn profile.

Certifications#

  • CRTA — Certified Red Team Analyst, CyberWarfare Labs
  • CAP — Certified AppSec Practitioner, The SecOps Group
  • CEH (Practical) — EC-Council
  • HTB CPTS — Certified Penetration Testing Specialist, Hack The Box
  • HTB Pro Labs — Dante and Mini Pro Labs P.O.O., completed
  • PortSwigger Web Security Hall of Fame — #24 (269/269 labs solved)

Currently working toward OSCP, C|PENT AI and LPT (Master).

Education#

  • ADP in Double Mathematics — 2022

Projects#

I build and maintain offensive security tooling. Recon automation, red-team web applications, malware analysis utilities and SOC log-analysis pipelines — most of it lives on GitHub.

Contact#